An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.

The remote host is affected by the vulnerability described in GLSA-201708-02 (TNEF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in TNEF. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       MIME attachment of type &ldquo;application/ms-tnef&rdquo; using TNEF, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Eric Sesterhenn, from X41 D-Sec GmbH, discovered several vulnerabilities in tnef, a tool used to unpack MIME attachments of type 'application/ms-tnef'. Multiple heap overflows, type confusions and out of bound reads and writes could be exploited by tricking a user into opening a malicious attachment. This would result in denial of service via application crash, or potential arbitrary code execution.

While fixing the above mentioned CVEs, upstream introduced a regression. The new patches added for this upload take care of that.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.9-1+deb7u2.

We recommend that you upgrade your tnef packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
102532	GLSA-201708-02 : TNEF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
97474	Debian DSA-3798-1 : tnef - security update	Nessus	Debian Local Security Checks	Local	high
97418	Debian DLA-839-2 : tnef regression update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2017-6308

high

Tenable Plugins

critical

high

high